What You'll Do
Incident Response | Primary Focus
- Lead significant security incidents from initial triage through scoping, containment, eradication, recovery, and post-incident review; provide escalation support and oversight for lower-severity incidents.
- Investigate email, identity, and business email compromise (BEC) incidents across Microsoft 365 and Entra ID, including sign-in activity, authentication changes, mailbox access, mail-flow activity, OAuth and application activity, and persistence mechanisms.
- Perform forensic triage of endpoints and servers using memory, disk, EDR, and log artifacts, and coordinate deeper forensic analysis when required.
- Serve as the technical escalation point for alerts and investigations from our MDR partner and coordinate response activities with affected Cybersecurity and IT teams.
- Build, maintain, and continuously improve the incident response plan, severity matrix, technical response procedures, and incident-specific playbooks.
- Develop scripts, queries, and repeatable workflows to automate evidence collection, enrichment, incident scoping, and common response activities.
- Plan and facilitate tabletop exercises for both technical teams and leadership to validate response procedures and identify opportunities for improvement.
- Preserve forensic evidence and maintain appropriate evidence-handling and chain-of-custody documentation.
- Produce clear incident reports, investigation findings, timelines, and briefings for both technical teams and leadership.
- Track and analyze incident response metrics, including time to detect, time to contain, time to recover, incident trends, and recurring root causes.
- Identify lessons learned from incidents and work with appropriate teams to improve controls, detection capabilities, and response procedures.
Detection and Threat Hunting
- Develop and tune SIEM searches, queries, and detections based on observed attacker techniques and organizational risk.
- Map detection coverage and identified gaps to MITRE ATT&CK where appropriate.
- Conduct targeted threat hunts using threat intelligence, observed indicators, attacker behaviors, and lessons learned from previous incidents.
- Identify logging, telemetry, and visibility gaps that affect detection or investigation capabilities and work with appropriate teams to address them.
- Translate findings from incidents and threat hunts into improved detections and investigation procedures.
Program Support
- Validate organizational exposure to actively exploited and high-risk vulnerabilities and provide risk-based remediation recommendations to vulnerability management and infrastructure teams.
- Support cybersecurity assessments of newly acquired companies and help integrate them into Sterling's security monitoring, detection, and incident response processes.
- Mentor other security analysts through shared investigations, technical reviews, knowledge transfer, and runbook development.
- Contribute to the continued maturity of Sterling's security operations and incident response capabilities.
What You Bring - Required
- 5+ years of experience in security operations, incident response, or digital forensics, including at least 3 years independently leading security investigations and response activities.
- Demonstrated experience leading complex security incidents, making containment recommendations with incomplete information, and coordinating technical response across multiple teams.
- Strong Microsoft 365 and Entra ID investigation skills, including Entra sign-in and audit logs, Microsoft Purview audit logs, mailbox activity and rules, authentication methods, Conditional Access, and related identity activity.
- Practical experience investigating business email compromise, account takeover, phishing, credential theft, and other identity-based attacks.
- Hands-on experience with enterprise EDR and SIEM platforms, including the ability to develop and troubleshoot your own investigative queries.
- Experience performing endpoint and server forensic triage using EDR telemetry, Windows event logs, memory, disk, and other available forensic artifacts.
- Solid understanding of Windows internals, Active Directory, authentication, and networking fundamentals, including TCP/IP, DNS, firewalls, and VPN technologies.
- Working knowledge of common attacker tactics, techniques, and procedures and frameworks such as MITRE ATT&CK.
- Scripting skills in PowerShell or Python with the ability to automate evidence collection, data analysis, enrichment, or repetitive investigation tasks.
- Strong analytical and problem-solving skills, including the ability to distinguish confirmed findings from assumptions and identify gaps in available evidence.
- Strong written and verbal communication skills, including the ability to explain technical findings, risk, and incident impact clearly to both technical teams and leadership.
- Ability to remain composed and make sound technical decisions during high-pressure security incidents.
- Willingness to participate in the cybersecurity on-call rotation and respond after hours when required during active incidents.
Preferred
- Certifications such as GCIH, GCFA, GCFE, or GNFA.
- Experience investigating incidents in complex, multi-company, decentralized, or M&A environments with mixed technology and security tool stacks.
- Experience working with managed detection and response providers and coordinating investigations between internal and external security teams.
- Experience developing or facilitating cybersecurity incident response tabletop exercises.
Education
- Bachelor's degree in cybersecurity, computer science, information technology, or equivalent combination of professional experience, training, and education.
PI288365693